PT-2022-12181 · Wondershare · Wondershare Dr.Fone

Published 2022-04-29 · Updated 2022-09-09 · CVE-2021-44595

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Wondershare Dr. Fone version as of 2021-12-06

Description The issue allows a normal user to send manually crafted packets to the ElevationService.exe, enabling the execution of arbitrary code without validation and granting SYSTEM privileges.

Recommendations For Wondershare Dr. Fone version as of 2021-12-06, consider restricting access to the ElevationService.exe until a patch is available to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2021-44595

Affected Products

Wondershare Dr.Fone

References · 10

• 🔥 http://packetstormsecurity.com/files/167036/Wondershare-Dr.Fone-12.0.7-Privilege-Escalation.html · Exploit
• 🔥 https://medium.com/@tomerp_77017/wondershell-a82372914f26 · Exploit
• 🔥 https://exploit-db.com/exploits/50912 · Exploit
• https://osv.dev/vulnerability/CVE-2021-44595 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44595 · Security Note
• https://t.me/cibsecurity/41631 · Telegram Post
• http://wondershare.com · Note
• https://medium.com/%40tomerp_77017/wondershell-a82372914f26 · Note
• http://dr.com · Note
• https://t.me/cvenotify/35941 · Telegram Post